Security Bulletin: Public disclosed vulnerability from OpenSSL and OpenSSH affects IBM Netezza Host Management

Summary

Open Source OpenSSL and OpenSSH is used by IBM Netezza Host Management. IBM Netezza Host Management has addressed the applicable CVEs. OpenSSL and OpenSSH rpms from RedHat are included in IBM Netezza Host Management for RHEL 6.

Vulnerability Details

OpenSSH :

CVEID:CVE-2016-6210
**DESCRIPTION:*A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could possibly use this flaw to determine valid user names by measuring the timing of server responses.
CVSS Base Score: 5.3
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2015-8325 DESCRIPTION: It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pam_env PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary code as root.
CVSS Base Score: 7
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

NOTE : OpenSSL and OpenSSH rpms from RedHat are included in Host Management release 5.4.24 and thus there is a expected change in versioning of rpms. The naming convention for RedHat is different and thus a different package version is expected. The latest OpenSSL package i.e 1.0.1e-57 and OpenSSH package openssh-5.3p1-123 is free from any security vulnerability.

If customers have applied PDA OS Security 2.0.18.12 or later release on their system then they do not need to apply the Host Management patch 5.4.24.0.

Affected Products and Versions

• IBM Netezza Host Management 5.3.5.1-5.4.23

Remediation/Fixes

To resolve the reported CVEs for Red Hat Enterprise Linux (RHEL) on following platforms :

PureData System for Analytics N3001
PureData System for Analytics N200x

Update to the following IBM Netezza Host Management release :

The Netezza Host Management software contains the latest RHEL updates for the operating systems certified for use on IBM Netezza/PureData System for Analytics appliances. IBM recommends upgrading to the latest Netezza Host Management version to ensure that your hosts have the latest fixes, security changes, and operating system updates. IBM Support can assist you with planning for the Netezza Host Management and operating system upgrades to your appliances.

For more details on IBM Netezza Host Management security patching:

• Red Hat Enterprise Linux (RHEL) Security Patching for IBM PureData System for Analytics appliances

Workarounds and Mitigations

None.